New year, new sector: Targeting India's startup ecosystem

Transparent Tribe, also known as APT36, has expanded its targeting to include India's startup ecosystem, particularly those in the cybersecurity domain. The group is using startup-oriented themed lure material delivered via ISO container-based files to deploy Crimson RAT. This campaign deviates from their typical government and defense targets, suggesting a shift in strategy towards companies providing open-source intelligence services and collaborating with law enforcement agencies. The attack chain involves spear-phishing emails, malicious LNK files, and batch scripts to execute the Crimson RAT payload. The malware employs extensive obfuscation techniques and uses a custom TCP protocol for command and control communications. This activity demonstrates the group's adaptation of proven tooling for new victim profiles while maintaining its core behavioral tactics, techniques, and procedures.

• July 2026 Threat Trend Report on APT Attacks (South Korea)Campaign2026-08-28
• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoorMalware2026-09-30
• Konni Hackers Target Ukraine With Malicious LNK Files and VelvetCake PowerShell MalwareMalware2026-09-24
• Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCHMalware2026-09-16
• BengalSEO Part 1: Anatomy of the OperationMalware2026-09-06